CVE-2026-98433 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using POWER9/10 systems with Ultravisor/PEF enabled, should assess exposure and prioritize patching due to the potential for permanent secure memory pool entry consumption and inaccessibility of affected GFNs.

Why it matters

Defenders should prioritize patching due to the potential for permanent secure memory pool entry consumption and inaccessibility of affected GFNs, which could lead to resource exhaustion on POWER9/10 systems with Ultravisor/PEF enabled.

• Permanent consumption of secure memory pool entries
• Inaccessibility of affected GFNs for the lifetime of the VM
• Potential for resource exhaustion on affected systems

Technical summary

The vulnerability occurs in kvmppc_svm_page_in() when uv_page_in() fails after kvmppc_uvmem_get_page() succeeds, causing a secure device page leak. This consumes one entry from the firmware-bounded secure memory pool and leaves the GFN marked as secure, making it unusable for the lifetime of the VM. The issue affects Linux kernel versions and could lead to resource exhaustion on POWER9/10 systems with Ultravisor/PEF enabled. Defenders should prioritize verifying and applying patches to affected Linux kernel versions.

Defensive priority

Defenders should prioritize verifying and applying patches to affected Linux kernel versions, particularly on POWER9/10 systems with Ultravisor/PEF enabled.

Recommended defensive actions

• Verify and apply patches to affected Linux kernel versions
• Review system configurations for POWER9/10 systems with Ultravisor/PEF enabled
• Monitor system resources for signs of secure memory pool exhaustion
• Conduct vulnerability assessments to identify potential exposure
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source references indicate a fix has been applied to the Linux kernel. However, details on affected versions and exploitation are limited. Defenders should verify and apply patches to affected Linux kernel versions, particularly on POWER9/10 systems with Ultravisor/PEF enabled, and monitor system resources for signs of secure memory pool exhaustion. The vulnerability occurs in kvmppc_svm_page_in() when uv_page_in() fails after kvmppc_uvmem_get_page() succeeds, causing a secure device page leak.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.